Packages / body-parser / Security

HighVulnerabilityGHSA-qwcr-r2fm-qrc7CVE-2024-45590Published 10 Sep 2024

body-parser vulnerable to denial of service when url encoding is enabled

Your version

Affected releases · body-parser

  • 1.x1.0.0 – 1.20.2Fixed in 1.20.3

On 1.x, the newest line:

npm install body-parser@1.20.3
Every release on a timeline
2.x

  1. Not affected

    2.0.0 – 2.4.0

    9 releases, latest

1.x

  1. Affected

    1.0.0 – 1.20.2

    70 releases

  2. Fixed

    1.20.3 – 1.20.9

    6 releases

85 stable releases of body-parser, oldest to newest, one row per major.

What happens

Impact

body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service.

Patches

this issue is patched in 1.20.3

References